Cyberattacks on Retailers: A Growing Concern for Businesses

A recent wave of high-profile cyberattacks has hit major retailers in the UK, with Marks & Spencer (M&S) losing approximately £300 million in profits from a targeted attack. The incident highlights the increasing risk of cyber threats and the need for businesses to invest in robust cybersecurity measures. Other retailers, including Co-op, Harrods, and Peter Green Chilled, have also been affected, with the hackers stealing personal information of thousands of customers.

Key Takeaways:

• Marks & Spencer (M&S) lost approximately £300 million in profits due to a highly sophisticated and targeted cyberattack.
• The attack, which was made public on 22 April, has suspended online purchases for weeks, left M&S supermarket shelves empty, and wiped over £1 billion off the company's market value.
• The hackers stole the personal information of thousands of customers, including emails, addresses, and dates of birth, but did not manage to obtain credit card or bank details.
• M&S has acknowledged relying on third-party suppliers for selected services and data hosting, which exposed it to vulnerabilities in cyber and data controls.
• The incident highlights the need for businesses to invest in robust cybersecurity measures, with over 75% of big UK companies experiencing a cybersecurity breach or attack in the past 12 months.
• The attackers, a group named Scattered Spider, are a loose collection of teenage and 20-something hackers from the US, UK, and Canada, operating on messaging apps like Telegram and Discord.
• The group has carried out 100 high-profile cyber raids, including extortion of Las Vegas resorts and casinos in 2023.
• Retail companies are an obvious target for hackers, with the threat of disruption and potential loss of sensitive information.

Statistics:

• Over £300 million lost in profits by M&S due to the cyberattack
• 22 April: the date Mark & Spencer made the attack public
• 12 months: the past period during which over 40% of UK businesses and 30% of charities have suffered a cybersecurity breach or attack
• 75%: the proportion of big UK companies that have experienced a cybersecurity breach or attack in the past 12 months
• 100: the number of high-profile cyber raids carried out by the Scattered Spider group
• £600,000: the ransom demand made by a gang that gained access to the British Library's servers in 2023
• 40%: the proportion of UK businesses that have suffered a cybersecurity breach or attack in the past 12 months

Sources:

• Zeki research firm, stating that Marks & Spencer, Co-op, and Harrods have cut corners on their in-house cybersecurity teams over the past decade
• Google, identifying the Scattered Spider group as the attackers
• Ollie Dent, a lawyer specializing in cybersecurity, stating that retail companies are an obvious target for hackers
• Government figures, indicating that over 40% of UK businesses and 30% of charities have suffered a cybersecurity breach or attack in the past 12 months